Digital Solutions & Online Creative 

Alex runs a small digital creative business from an office in London. It's called Outside In Media.

About

SOYREX is a web development and design resource intended as a place for me to share tips and tricks relating to html, css, web design, web development and other internet and web topics. If you like what you read, leave a comment, or send an email. Also, check out my company web site.

This form does not yet contain any fields.
    Search the Archives

    Online Schools

    Currently Reading..
    • Blink: The Power of Thinking Without Thinking
      Blink: The Power of Thinking Without Thinking
      by Malcolm Gladwell

      Blink talks about flash cognition and sub-conscious cognitive activity.. awesome read!

    • Confessions of an Economic Hit Man: The Shocking Story of How America Really Took Over the World
      Confessions of an Economic Hit Man: The Shocking Story of How America Really Took Over the World
      by John Perkins

      Confessions of an Economic Hit Man - i knew the world was a big conspiracy.. but this is a gripping insight into how the world really works.

    Recommended Reading
    • Designing with Web Standards (Voices That Matter)
      Designing with Web Standards (Voices That Matter)
      by Jeffrey Zeldman, Ethan Marcotte
    • Web Standards Creativity: Innovations in Web Design with XHTML, CSS, & DOM Scripting: Innovations in Web Design with XHTML, CSS, and DOM Scripting
      Web Standards Creativity: Innovations in Web Design with XHTML, CSS, & DOM Scripting: Innovations in Web Design with XHTML, CSS, and DOM Scripting
      by C et al Adams
    Tuesday
    Aug252009

    I hate spam bots. But i hate captcha more.

    I posted a message a while back about spam in comments and Django. I don't agree with a lot of the opinions I held at the time, however one point I raised that I believe holds true is that the responsibility for spam provention should be the developers, not the user. In short, I hate and completely disagree with "captcha" style spam protection on forms. As a user I find sometimes, in attempt to make the image in unreadable by a computer that the text is so obscure I find it difficult to read myself. This isn't good enough.

    This point holds especially true for the project I am currently working on, which has only a simple email contact form. I do not want a valid, human client to have to tackle entering a captcha image or solving a math problem just o send the company a contact. So I set about reading about ways to catch spam on the server side.

    My Solution

    The solution that i've come up with marries two fairly old concepts together with some fairly simple logic (the success of this is untested, however I think it should be fairly effective - time will tell.. and i'll keep people posted here)

    The two techniques I will be using are: timestamping and honeypots.

    So what are they?

    Timestamping

    The concept of timestamping involves sending a timestamp to the form and storing it in a hidden field, effectively allowing us to know when the form was rendered. This is useful for two reasons:

    1) We can check that the user spent a reasonable amount of time filling out hte form. The theory here is that the user is unlikely to instantly post the form, however a spam bot that has scraped the data down will very quickly be able to scrape out the form fields and post the page. So: for example in this current project, my contact form is asking for a name, email, subject and message. A human cant type these into a form in less than say 5-10 seconds, so when the form is submitted i can check the timestamp in the hidden field against the current time and thus reject a submission that is too rapid.

    2) We can force the form to expire after say 1 hour, provide the user with a simple message that says something like "sorry, the form has expired.. please try again".

    Obviously the too fast time would depend on the size of the form that you are requiring them to fillout.

    The secret here also is to NOT redirect to the form page, but to store the form values they have created into session, so that we can provide a link saying click here to re-submit the form, and explaining that the client needs to wait 10 seconds before sending the form.

    Honeypots

    Honeypots are used to trick spambot engines into telling us they are a spam bot. Basicallly the logic is as follows: a spambot tries to guess the values for the inputs in a form when it submits it. SO: if we use CSS to completely hide a honeypot text field, then the spambot is likely to try and guess a value for that field - then we assume that any submission with a value in that field is a bot, and display a message suggesting as much, if they are not a bot, we allow them to click a button to submit the form - this should in theory prevent a bot successfully submitting the form.

    Time will tell how well these two techniques will work together to cut back on spam. If anyone is interested, i could probably tidy up the django code and release it as an app for people to play with...

    PrintView Printer Friendly Version

    EmailEmail Article to Friend

    Reader Comments (24)

    I was thinking about writing something like this myself (I heard about it somewhere else), so I would be interested in the code. If you could release this as an app that would really be great. Otherwise just a code dump here would be nice as well.

    TiNo

    August 27, 2009 | Unregistered CommenterTino de Bruijn

    Nice post Alex. I have several colleagues who are getting hammered with spambot logins and registrations, about 50 per day. One colleague is going to try geobytes, which will redirect visitors from certain countries to a url of your choice. Id like to send the bots to a black hole of sorts but dont know enough about that to really help at this point. If you have any suggestions please email me directly. Thanks.

    August 27, 2009 | Unregistered CommenterFlorida Web Design

    Captcha's are one of the greatest inventions of all time. Not only do they prevent all of the useless spam I was getting, they also help translate books that cannot be properly read through OCR.

    Just because you throw a bitchfit every time you dislike something, doesn't mean they are a bad thing.

    December 7, 2009 | Unregistered CommenterMobile Web User

    @Mobile Web User: An incredibly informed comment.. well done.

    You might want to try reading the article.. placing the responsibility for spam on the user is a stupid idea - i stand by that.

    December 11, 2009 | Registered Commenterrex

    Clever solutions! In my recent spam-killing attempts, CAPTCHA has felt like a necessary evil, but these 2 filters might change my ways (especially since some of the sites I've worked on are beginning to get popular enough for the CAPTCHA-reading bots to take notice). Do you have any word on how effective this has been for you so far?

    January 4, 2010 | Unregistered CommenterAnthony Navarre

    this is interesting. let me know when it comes out: spam.smith1234@gmail.com

    January 8, 2010 | Unregistered Commenterspam.smith1234@gmail.com

    tats interesting but can't the bots be made such tat tey fill the forms in may be a minute or mre????in tat case won't the timestamp idea fail??

    February 20, 2010 | Unregistered Commenterbhu

    I love the honeypot idea, definitely going to give it a go!

    March 2, 2010 | Unregistered CommenterBenjamin Reid

    I know some people use things like roboform to fill out forms which might also false trigger the time stamp.

    March 3, 2010 | Unregistered CommenterNatetronn

    I like your site. It’s really simple and cool without no much of put ups. I am also going to design my site simple and nice as yours

    June 13, 2010 | Unregistered CommenterPK

    Is it not ironice that the post on June 25th 2010 was by a spambot?

    June 30, 2010 | Unregistered CommenterDerek

    Hey Derek. You're quite right. The new site is hosted at squarespace, and their spam protection isn't really all that great. I moderate the comments on the site now and then.. and it keeps it pretty clean, but i missed that one on the 25th (i've killed it now)

    July 9, 2010 | Registered Commenterrex

    I am also going to design my site simple and nice as yours.When you want to know the answer such as pizza cost.How to order pizza online? How to buy papa johns paypal. or order pizza hut paypal. Please tell me.

    July 14, 2010 | Unregistered Commenterpizza

    I really like your website http://soyrex.com, our website as well。coach outletis the market popular longest and most successful leather brand. Especially the coach handbagsand coach bags have a good reputation for quality and exquisite craft in female consumers.
    MBT shoes
    reebok easy tone
    shape ups shoes
    P90X
    P90X Workout
    P90X DVD-Fitness
    birkenstock sandals
    birkenstock gizeh
    birkenstock Madrid

    July 14, 2010 | Unregistered Commentercoach outlet

    <p>We are a professional supplier of wholesale designer handbags ,wholesale gucci,please feel free to
    contact us if you need fashion handbags.
    Find all the latest fashion, brown handbag, celebrity gossip and leather handbags!
    Different Colors And Sizes Available. </p>
    We take pleasure to introduce ourselves as manufacturers and exporters of all kinds of ladies high heel shoes.We are manufacturers and exporters of all kinds of high shoes. We specialize in wedding shoes fitted with Swarovski and imitation diamond

    July 14, 2010 | Unregistered CommenterFrank

    Discount Louis louis vuitton handbags Vuitton Handbags,Wallets & Purse louis vuitton Online Store. In

    louis vuitton replica handbags the my lv replica handbags store buy designer handbags cheap Louis louis vuitton handbags Vuitton Handbags, You replica handbags best choice.louis vuitton,louis vuitton handbags,louis vuitton handbag,louis louis

    vuitton handbags vuitton bags,louis vuitton bag,louis vuitton wallets,louis vuitton wallet,gucci,gucci wholesale louis vuitton

    handbags handbags,gucci handbag,gucci bags,gucci bag,gucci wallets,gucci wallet,prada,prada handbags,prada handbag,prada bags,prada wholesale replica handbags bag,prada wallets,prada wallet,buy prada handbag.
    815GSW0715

    July 15, 2010 | Unregistered CommenterReplica Handbags

    HD PROVIDENCE
    contains interactive features available only on this format. PROVIDENCE DVD
    authoring has been an expensive affair, such as PROVIDENCE DVD COLLECTION
    .

    Bentley GT
    have become a trend in fashion circles. It is a beautiful automatic chronograph stainless steel Breitling Aeromarine
    . Go to a renowned retail store of Breitling Windrider
    and shop to away for your new Bentley 6.75
    today.


    Hogan
    produces great athletic shoes in hogan donna
    categories, you can pick Hogan scarpe uomo
    along with give it a try. I’m not simply speaking about all skyscraping but Hogan uomo
    .

    July 15, 2010 | Unregistered Commenterhogan scarpes uomo

    Latest insanity workout dvd
    Px90
    px90 exercise program
    workout-px90 Lets you easily fitness
    insaity workoutLet you have vigor
    cheap insaity workout Let you be stronger
    Mbt shoesspecial style
    Mbt safiridifferent designs
    MBT ChapaPersonality
    such a trend welcome to buy!thank you!

    July 21, 2010 | Unregistered Commenterpx90

    Welcome to <A href="http://www.b2bsharing.com/christian-louboutin-shoes-c-4463.html">Christian Louboutin Shoes</A> on-line store! Now an extensive selection of super <A href="http://www.b2bsharing.com/christian-louboutin-shoes-c-4463.html">Fashion Christian Louboutin Shoes</A> with different colors and styles are provided at the most competitive prices. You can buy <A href="http://www.b2bsharing.com/christian-louboutin-shoes-christian-louboutin-pumps-c-4463_4466.html">Christian Louboutin Pumps</A>,<A href="http://www.b2bsharing.com/christian-louboutin-shoes-christian-louboutin-boots-c-4463_4465.html">Christian Louboutin Boots</A>,<A href="http://www.b2bsharing.com/christian-louboutin-shoes-christian-louboutin-sandals-c-4463_4467.html">Christian Louboutin Sandals</A> at our online store. Our goal is to make all of you enjoy the top fashion and become the most charming women with our beautiful shoes.The world's best <A href="http://www.b2bsharing.com/christian-louboutin-shoes-c-4463.html">wholesale Christian Louboutin Shoes</A> website.Buy now!

    July 24, 2010 | Unregistered Commenterhei

    Not long ago, Tag Heuer cooperated with Porsche Club of America to launch the exact amazing restricted edition Tag Heuer Porsche Club of America which is extremely desirable by the exact view connoisseurs. This new model is issued to celebrate the exact 50 years anniversary of the exact Porsche Club of America. replica victorinox watches It is especially designed for racing with an appearance inspired by the exact Monaco chronograph model made by Mc’Queen in the exact 1970s. It perfectly combines the exact cool colors-red, black and white.

    July 27, 2010 | Unregistered Commenterivan.watcheslux

    In our BagOnHand which also is fantastic Louis Vuitton online store. you will find discount LV wallets,handbags, bags ,luggage for best deals.It is real eye-opener for newest design to U and latest releases.We offer wholesale cheap price with first grade material.Wonderful combination of letter symbols "Louis Vuitton"(LV) with classical Louis Vuitton monogram pattern and interesting cartoons make LV purses give off new luster and brilliance.The Louis Vuitton purse and handbag, the appearance is very attaticve and elegant .discount handbags It is for easy, Women's Handbags city chic fee,Designer Handbags the "Louis Vuitton"(LV) combines sophisticated comfort and detailing of the handbag and make the handbag perfect for everyday useIt include :Gift Handbag,LV Tag,Care Booklet,women's wallets Dust Bag,Identity Card in Envelope with handbag.

    July 27, 2010 | Unregistered Commenterbagonhand

    Thank you for sharing such good experience.I also like to write such things in own blog. Our watches are very good!

    July 27, 2010 | Unregistered Commenterreplica watches

    PostPost a New Comment

    Enter your information below to add a new comment.

    My response is on my own website »
    Author Email (optional):
    Author URL (optional):
    Post:
     
    Some HTML allowed: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <code> <em> <i> <strike> <strong>
    « Pragmatics vs Validation | Main | Expanding your reach with Twitter.. »